Comparing Independent Security Audits Across VPN Brands

Search for a privacy-focused VPN and you will see the word "audited" on almost every landing page. Some of those claims rest on a long, public report written by an outside firm. Others rest on a single paragraph and a logo. If you are choosing between two providers, it is tempting to treat both as equal because both use the word. They are not, and the difference is often visible in the documents themselves if you know where to look.

This article is not a ranking of brands, and it does not name any. Rankings go stale and are often paid for. Instead it gives you a method: a set of questions and a worksheet you can fill in for any provider, so that you compare like with like. Before you start, you may want to read our introduction to what a VPN audit is, which covers the basics. This piece assumes you already know what an audit is and want to compare several of them.

Why audit claims are hard to compare

An audit is a structured examination by someone other than the provider. That is the only thing the word guarantees. Everything else varies.

• The subject. A report may examine a written privacy policy, how servers are configured, the code of an app, the infrastructure that handles accounts, or a mix.
• The method. A reviewer may read documents, interview staff, inspect configurations, run tests against a system or read source code line by line.
• The depth. A one-week review of a sample of servers is not the same as a long engagement with access to everything.
• The result. A report may list findings and their severity, or it may present one reassuring paragraph.
• The publication. Some providers publish the full report. Some publish a summary. Some share a letter from the auditor. Some publish nothing beyond a badge.

Because providers choose what to commission and what to publish, two "audited" brands can sit at opposite ends of the evidence scale. The task is to read enough of the document to place each provider on that scale.

The six questions to ask of every report

Use these six questions on every audit you find. Write the answers down; the pattern becomes clear quickly.

1. What exactly was examined?

Look for a scope section. A clear scope names the systems reviewed, such as "the production servers that handle customer connections", "the Windows and Android apps at version X" or "the process for handling legal requests". Anything not named is outside the scope. A scope that says only "the service" without detail is weak.

2. What claim was tested?

Some reports test a specific, checkable statement, for example that servers do not store certain categories of data. Others test general security hygiene, such as patching and access control. Both are useful, but they answer different questions. If your concern is what a provider records about you, a penetration test of the app does not answer it, and vice versa. Our overview of what a VPN provider can see helps you decide which claim matters most to you.

3. Who did the work, and how independent are they?

Check that the auditor is a named firm with a track record in security or assurance. Be cautious when the auditor is a consultancy that also sells services to the provider, or when the report was written for marketing rather than for assurance. Independence does not mean hostility, but it does mean the provider cannot edit the conclusions.

4. When was it done, and which version was covered?

A date and a version are non-negotiable. A report on last year's app says little about this year's. Look for the period covered and whether the provider says what has changed since. A provider who repeats audits on a schedule signals that it treats assurance as ongoing work.

5. What did the auditor find, and what happened next?

A report with zero findings is rare for any real system. Honest reports list issues, rank them by severity and describe the provider's response. A provider that publishes a follow-up showing which items were fixed is giving you stronger evidence than one with a spotless, vague summary.

6. Is the full report available, and where?

A link on the provider's own site is good. A copy hosted by the auditor is better, because the provider cannot quietly replace it. If only an excerpt is public, check whether the summary says what is left out.

A worksheet you can copy

Take two or three providers and score each from 0 to 2 on each row: 0 means absent or unclear, 1 means partly there, 2 means clear and documented. The numbers are only a way to see differences, not a formal rating.

Question	Provider A	Provider B	Provider C
Scope clearly named
Claim tested is specific and checkable
Auditor named and independent
Date and software version stated
Findings listed with severity
Remediation or follow-up published
Full report publicly available
Repeated on a regular schedule

A total near the top suggests a provider that treats auditing as accountability. Low totals do not prove misconduct, but they mean you are relying on trust rather than evidence. Notice that the worksheet does not reward the word "audited". It rewards documentation.

How different audit types answer different questions

Not every audit is meant to answer a privacy question. Knowing the type tells you what you can conclude.

Audit type	What it tells you	What it does not tell you
Policy or assurance review	Whether the provider's practices match what it says in writing	Whether the software has security flaws
Infrastructure or configuration review	How servers are set up and what they store	Whether the apps are free of bugs
Application penetration test	Whether an attacker could break the app or leak traffic	Provider's data-handling decisions
Source code review	Whether the code does what is claimed, at that version	Behaviour of servers you cannot see
Compliance certification	That a documented process is followed	Anything beyond the standard's scope

A provider with a strong application test and no infrastructure review has given you evidence about its software but not about its servers. A provider with a policy review and no technical work has given you words checked against other words. The best evidence combines several types over time.

For the language providers use to describe what they record, read our guide to VPN logging policies. A transparency report adds another layer, covering how often authorities ask for data and what happened. See VPN transparency reports for how to read one.

Reading the documents: red flags and good signs

Spend ten minutes on each report and look for these markers.

Red flags

• The scope is vague or limited to something unrelated to the claim being advertised.
• The report is a one-page letter with no description of method.
• The auditor is not named, or is a firm that appears to exist mainly to issue badges.
• The date is old, or the version does not match the current app.
• The marketing claim goes beyond what the report says, such as "completely private" when the report tests only one component.
• The link leads to a gated page, or the document has been removed.
• The report was commissioned by a different company or a previous owner.

Good signs

• Findings are listed with severity ratings and the provider's response.
• Multiple audits over several years, each with a clear scope.
• A published roadmap of what will be audited next.
• A bug bounty or a clear security contact alongside the audit.
• Plain statements about what the audit did not cover.

Three worked comparisons

A. The badge versus the report. Maya compares two providers. One shows an "audited" seal at the top of its site but offers no link. The other links to a 40-page report by a named firm, with a stated scope, a date within the last year, a list of findings and a note on which were fixed. On the worksheet, the first scores 1 out of 16 and the second 13. She has not learned that the second is perfect, but she has learned which one gives her something to verify.

B. Two real reports with different scopes. Dev finds two providers that both publish reports. One report examines the apps and finds several medium issues, all fixed. The other examines server configuration and reports on what is stored. Neither is better; they answer different questions. Dev decides he cares more about what is stored, so he reads the second more carefully, then asks the first provider whether a server review exists.

C. The old audit. A provider cites an audit from several years ago. Since then it has changed ownership, rewritten its apps and added new server infrastructure. Maria reads the report, sees that it covers a system that has largely been replaced, and treats it as history, not evidence. She emails the provider and asks whether a more recent review exists. A prompt, specific answer is itself informative.

What an audit cannot tell you

An audit has limits that no comparison table fixes.

• It is a snapshot. The system you use tomorrow may differ from the system that was examined.
• It covers only what was in scope.
• It cannot prove that something never happens, only that it was not found during the work.
• It does not replace your own sensible habits: updated apps, unique passwords, two-factor sign-in and care with links.
• It does not tell you how a company will behave when its ownership, finances or legal situation changes. That is a question of trust, which our piece on the VPN trust model discusses.
• It does not substitute for testing. You can still check the basics yourself, as described in how to test a VPN.

For a wider scorecard that goes beyond audits, see how to compare VPN providers.

A short email you can send

If a provider's audit information is unclear, ask. A short, specific message works well.

1. Say which report or claim you are asking about.
2. Ask whether a full copy is available and where.
3. Ask which software version and which systems were covered.
4. Ask when the next review is planned.
5. Ask what changed since the last report.

Providers that welcome these questions usually have good answers ready. Slow, vague or defensive replies are also useful information.

Summary

"Audited" is a starting point, not a verdict. Compare reports by scope, tested claim, auditor independence, date and version, findings and remediation, availability and repetition. Different audit types answer different questions, so match them to your own concern and remember that every audit is a snapshot. Use a worksheet to keep the comparison fair, ask the provider when something is unclear and combine audit evidence with clear terms, a transparency report and your own testing.

If you prefer a prepaid pass that ends on its own while you do this homework, you can look at the pricing page when you are ready.